This invention relates to verifying the authenticity of web sites to help prevent fraud.
The world wide web is often used for sensitive transactions such as those involved in online banking and e-commerce. In a typical scenario, a user obtains access to an account at a financial institution by supplying a valid username and password.
The popularity of online services has given rise to fraud. One type of fraud, known as “phishing” involves sending fraudulent email messages to recipients to entice them to reveal their username and password or other sensitive information to an unauthorized party. Often the content of a fraudulent email is in html format and contains graphics and text that make the recipient believe that the fraudulent email was sent by a legitimate institution. For example, the fraudulent email may contain an accurate rendition of the logo of the recipient's bank.
The text of the fraudulent email may instruct the recipient to click on an embedded web link. When the recipient clicks on the web link, the recipient's web browser presents the recipient with a fraudulent web page that appears to be associated with the recipient's institution. The fraudulent web page generally contains the institution's logo and other content that makes the web page difficult or impossible to distinguish from a legitimate web page associated with the institution. The fraudulent web page also contains text that prompts the recipient to login to the institution by supplying appropriate credentials such as a username and password. When the recipient clicks on a login button on the fraudulent web page, the recipient's username and password are transmitted to the perpetrator of the fraud. The user credentials that have been fraudulently collected in this way may then be used to make unauthorized transactions at the recipient's institution.
It is therefore an object of the present invention to provide ways in which to help prevent fraud by verifying whether web sites are legitimate.